XBOW and OpenAI's GPT 5.6 Sol built a full chain Chrome exploit in six days, winning Google's first $250,000 full chain bounty of 2026
For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW. Here’s the full story: At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August. I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices. Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population. A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough. So @moyix, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol. They built a chain they thought would win, but Google told us they already knew one of the bugs. We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win. So Brendan and the agents built a new exploit in just 6 days. We submitted it to Google and waited. The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules. It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability. My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public. But defenders have one advantage attackers never will: they can test their own code first. Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did. This is cause for urgency but not panic. XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product. If you’d like to be one of them, get in touch. P.S. Restart Chrome whenever the Update button appears!
Context
An AI system helping build a working full chain exploit against one of the most hardened programs in the world shows how fast AI is changing both attack and defense in cybersecurity.
Oege de Moor is the founder and CEO of XBOW, an AI security company, so this is first hand. OpenAI president Greg Brockman also posted about it, since the work used OpenAI's model. XBOW published a technical write up, and Google fixed the bugs, according to the write up.
Deep dive
On October 13, Oege de Moor posted that for the second time in Google Chrome's history, Google had awarded a $250,000 bounty for a full chain exploit, to XBOW.
He wrote that at the start of 2026 he challenged the team to build a full chain exploit of Chrome by the Black Hat conference in August, as a test of whether XBOW could move beyond web applications. He explained that a full chain exploit lets an attacker take total control of a machine just by having a user visit the wrong site.
He wrote that a small team worked with a fifth teammate, OpenAI's GPT 5.6 Sol, but Google said it already knew one of their bugs. He said the team and the agents then built a new exploit in just six days, which earned the first full chain bounty under Google's 2026 rules, at a cost of $40,000 of compute.
XBOW's write up says the chain used a flaw in Chrome's V8 Maglev compiler, a flaw in its animated WebP decoder and a flaw in its Crashpad crash reporter to escape the browser sandbox.
Greg Brockman posted that the result highlights the opportunity for defenders to use these tools to secure their software to unprecedented levels, and said the bug would have affected an estimated 1 billion users.
What to expect next
Watch whether Google and other software makers expand bounty programs or change rules as AI systems find serious bugs faster and more cheaply.
Also watch whether similar AI assisted exploits appear outside bounty programs, and whether defenders adopt the same tools quickly enough to find these flaws first. Google's own response, including any change to how it rewards AI assisted research, will show how browser makers plan to handle a rising volume of AI found bugs.